Environment Variables & Configuration with Zod

process.env is where an Express app's real configuration lives, database URLs, API keys, ports, but TypeScript types every property on process.env as string | undefined, and nothing stops a typo'd or missing variable from reaching production. Validate it with Zod the same way you validate a request body.

import { z } from 'zod';

const EnvSchema = z.object({
  PORT: z.coerce.number().int().positive().default(3000),
  DATABASE_URL: z.string().url(),
  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
});

const env = EnvSchema.parse(process.env);
// env.PORT is typed as number, env.DATABASE_URL as string, both actually checked

z.coerce.number() converts the incoming string (everything in process.env is a string) to a number before validating it, exactly what an environment variable needs, PORT arrives as the string "3000", not the number 3000. Calling EnvSchema.parse(process.env) once, at startup, means a missing or malformed DATABASE_URL crashes the app immediately with a clear error, instead of failing mysteriously the first time a database query runs, minutes or hours later.

A typed config module

// config.ts
import { z } from 'zod';

const EnvSchema = z.object({
  PORT: z.coerce.number().int().positive().default(3000),
  DATABASE_URL: z.string().url(),
});

export const config = EnvSchema.parse(process.env);

// index.ts
import { config } from './config';

app.listen(config.PORT, () => console.log(`Listening on ${config.PORT}`));

Importing config instead of reading process.env directly anywhere else in the codebase means every other file gets a fully typed, already-validated object, no string | undefined and no repeated validation.